First some software details: Thin client: Wyse C10LE Citrix -> Windows Terminal Services -> Windows Server 2008 Enterprise desktop

I have a user with a very strange problem. When he locks his screen with Win+L, Windows claims he's entering wrong password when he tries to log back in. The only solution is to hard reboot the WYSE, and log back in. This reboot doesn't kill his Windows session.

I've checked for errors in keyboard settings (wrong layout etc), nothing found. I suspect errors in his profile/errors in AD. No other users in the domain has this problem.

EDIT: Sorry, it's NOT Win R2. Plain Windows Sever 2008

  • He's not locking the Thin Client, rather than the server is he? Test this by locking via the Start Menu -> Windows Security. Have you tried connecting from an alternative device (Something completely different) and seeing if the issue is the same. What happens when using RDP to connect?
    – Dan
    Nov 6, 2012 at 10:15
  • No, he is locking the server. That's for sure. I've recently asked him to try an another device. Waiting for status. He is not able to login via RDP.
    – LarsErikP
    Nov 6, 2012 at 10:28
  • I'd recommend temporarily giving him access to RDP, just to prove the point. Chances are you can eliminate Citrix from the equation. I'm not familiar with the C10LE - are you using PNAgent, or logging in through the Web Interface?
    – Dan
    Nov 6, 2012 at 10:32
  • It's not possible to give him access to RDP.. The environment has one PDC, and some other DCs. The log tells me that tis particular users autheticates with one of the DCs (which i presume checks with the PDC). Are there any difference between "cold" logon, and logon from the screen saver, in this context?
    – LarsErikP
    Nov 6, 2012 at 10:52
  • Why can you not give him access to RDP? To the best of my knowledge, the machine will 'authenticate' locally when unlocking. I don't believe it needs to contact the DC again. So yes, the mechanisms, will be totally different. This feels like one of those really weird errors that'll turn out to be something trivial, rather than some big back end issue.
    – Dan
    Nov 6, 2012 at 11:08

1 Answer 1


Unlock settings depends on security policy. This policy is called "Interactive logon: Require Domain Controller authentication to unlock". By default user can unlock the computer using cached credentials. It seems Your user has wrong cashed credentials in his login. You use roaming profiles. The easy way to solve this problem -

  1. backup User data from Roaming profile

  2. remove his profile from server,or just rename his profile folder.

  3. Let user login again

You can remove user profile using powershell

$User = "User SID"
$server = "Myserver"
Get-WmiObject win32_userprofile -filter "SID='$user'" -ComputerName $server | foreach {$_.Delete()}
  • We actually tried this today. Same problem with a brand new profile.. And the GPO which forces AD auth to unlock is active for the user. This is getting very weird...
    – LarsErikP
    Nov 7, 2012 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.